ASEC documented an attack campaign attributed to Larva-26009 targeting internet-facing MS-SQL servers, in which attackers escalate from initial command execution to installing web shells, privilege escalation tools (JuicyPotatoNG, SigmaPotato, BadPotato, RustPotato), remote access tools (GotoHTTP, VShell, Chrome Remote Desktop), backdoor accounts, and ultimately deploying XMRig CoinMiner alongside a SoftEther VPN server configured in cascade mode to obscure C2 infrastructure. The actor leverages legitimate/dual-use software (Cloudflared, Chrome Remote Desktop, a patched NVIDIA utility) and encrypted shellcode loaders (RingQ) to evade detection while maintaining persistent, multi-stage access.
vshell
1 post
Case Study: Targeted Attack Case on an MS-SQL Server Involving the Installation of GotoHTTP and SoftEther VPN